From 93dce707f1f8f5bd86761b96d361b2bea359d777 Mon Sep 17 00:00:00 2001 From: Wen Date: Wed, 14 Oct 2026 14:37:06 -0300 Subject: [PATCH] docs(social-publisher): require user approval before socialclaw apply apply creates real posts, but the workflow went straight from validate to apply. Require showing every post and getting explicit approval first. Also note that the CLI only takes the API key as an argument, so the user should run login themselves instead of the agent. Signed-off-by: Wen --- manifests/context-packs/skill-triggers@1.json | 2 +- skills/social-publisher/SKILL.md | 5 +++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/manifests/context-packs/skill-triggers@1.json b/manifests/context-packs/skill-triggers@1.json index a49a8c824..914eab660 100644 --- a/manifests/context-packs/skill-triggers@1.json +++ b/manifests/context-packs/skill-triggers@1.json @@ -10,7 +10,7 @@ "id": "hand-seeded", "source": "manual-curation-pending-regeneration" }, - "registryDigest": "498caee2738006d64530e9be34883111cf67742d8c4389f39d61299e1a1c4400", + "registryDigest": "1d14cd6ec03edb45961728e5a16e21d578d248f6e259d291320a0a5ca4f5232e", "schemaVersion": 1, "triggers": { "skill:agent-runtime-gateway-smoke-test": [ diff --git a/skills/social-publisher/SKILL.md b/skills/social-publisher/SKILL.md index a00651738..b745b504c 100644 --- a/skills/social-publisher/SKILL.md +++ b/skills/social-publisher/SKILL.md @@ -32,6 +32,8 @@ npm install -g socialclaw@0.1.12 socialclaw login --api-key ``` +The CLI takes the key only as the `--api-key` argument and saves it to `~/.socialclaw/config.json`. While the command runs, other local users can see the argument in `ps`, and your shell may keep it in history. Run `socialclaw login` yourself, once, in your own terminal; do not have the agent expand `$SC_API_KEY` into the command line. + ## Core Workflow ### 1. List connected accounts @@ -83,6 +85,9 @@ socialclaw validate -f schedule.json --json ``` ### 5. Publish + +`apply` creates or schedules real posts on the user's accounts. Before running it, show the user every post in the validated `schedule.json` (provider, account, text, media, `scheduled_at`) and get explicit approval. If `schedule.json` changes after approval, ask again. Never run `apply` in the same step that generated the content. + ```bash socialclaw apply -f schedule.json --json # → { "run_id": "..." }